Fortinet v3.0 MR7 manuale d’uso

www.fortinet.com FortiO S v 3. 0 MR 7 User Authentication User Guide USER GUIDE[...]

FortiOS v3.0 MR7 User Au thentication User Guide 28 Aug 2008 01-30007-03 47-20080828 © Copyright 2008 Fortine t, Inc. All rights reserved. No part of this publication including text, examples , diagrams or illustrations may be reproduced, tra nsmitted, or translated in any fo rm or by any means, electronic, mechanical, man ual, optical or otherwis[...]

Contents FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 3 Contents Introduction ............... ................................. .............................. .......... 5 About authentication .................. ................ ................ .................... ................ ... 5 User’s view of authentication .[...]

FortiOS v3.0 MR7 User Authentication User Guide 4 01-30007-0347-200808 28 Contents Users/peers and user groups ................ ............................... .......... 31 Users/peers ........... ............. ................ ............. ................ ............. ................ .... 31 Creating local users ......... ................ ...[...]

Introduction About authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 5 Introduction This section introduces you to the authe ntication process from the user and the administr ato r s per sp ec tive , an d pr ov ides supplementary informa tio n about Fortinet publications. The following topics are co vered in thi[...]

FortiOS v3.0 MR7 User Authentication User Guide 6 01-30007-0347-200808 28 User ’s view of authentication Introduction User ’ s view of authentication The user sees a req uest for au thenticat ion when they try to access a protected resource. Th e way in which the request is presented to th e user depends on the method of access to that resource[...]

Introduction FortiGate administrator ’s view of authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 7 FortiClient can store the user name and password for a VPN as part of the configuration for the VPN conn ection an d pass them to the FortiGate unit as needed. Or , FortiClient can request the user name a nd pas[...]

FortiOS v3.0 MR7 User Authentication User Guide 8 01-30007-0347-200808 28 FortiGate administrator ’s view of authentication Introduction 3 Create use r groups. Add local/peer user members to each use r group as appropriate. Y ou can also add an authentication serv er to a user grou p. In this case , all users in the ser ver’s database can authe[...]

Introduction FortiGate administrator ’s view of authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 9 Public Key Infrastructure (PKI) authentication A Public Key Infrastructure (PKI) is a comprehensive system of policies, processes, an d te ch no log ie s w ork in g toge t her to enable users of the Internet to [...]

FortiOS v3.0 MR7 User Authentication User Guide 10 01-30007-0347-200808 28 About this document Introduction Authentication timeout An authentica ted connect ion expires when it has been idle for a len gth of time that you specify . The authenticat ion timeout value set in User > Au thentication > Authentication applie s to every user of the s[...]

Introduction FortiGate documentation FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 11 • In the examples, private IP addre sses ar e used for both private and public IP addresses. • Notes and Cautions are used to provide impo rtant information: Typographic conventions FortiGate document ation uses the fo llowing typogra[...]

FortiOS v3.0 MR7 User Authentication User Guide 12 01-30007-0347-200808 28 Related documentation Introduction • FortiGate Administration Guide Provides basic informati on about how to configure a For tiGate unit, including how to define FortiGate pr otection profiles and firewall p olicies; h ow to apply intrusion prevention, antivirus protecti o[...]

Introduction Related documentation FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 13 FortiManager documentation • FortiManager QuickS tar t Guide Explains how to install the FortiMana ger Console, set up the FortiManager Server , and configure basic settings. • FortiManager System Admini stration Guide Describes how to [...]

FortiOS v3.0 MR7 User Authentication User Guide 14 01-30007-0347-200808 28 Customer service and technical support Introduction Fortinet Tools and Documentation CD All Fortinet document atio n is availab le from the Fo rtinet T ools and Do cument ation CD shipped with your Fortinet product. The document s on this CD are current at shipping time. For[...]

Authentication servers RADIUS servers FortiOS v3.0 MR7 User Au thentica tion User Guide 01-30007-0347-2008082 8 15 Authentication servers FortiGate unit s support the use of authenti cation servers. If you are going to use FortiGate authentication servers, you must configure the servers before you configure FortiGate users or user group s that requ[...]

FortiOS v3.0 MR7 User Authentication User Guide 16 01-30007-0347-200808 28 RADIUS servers Authentication servers In order to supp ort vendor-sp ecific attributes (VSA), th e RADIUS server requires a dictionary to define what the VSAs are. Fortinet’s dictionary is configured this way: ## Fortinet’s VSA’s # VENDOR fortinet 12356 BEGIN-VENDOR fo[...]

Authentication servers RADIUS servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 17 • Change the FortiGate unit de fault RADIUS port to 1645 using the CLI: config system global set radius_port 1645 end T o configure the FortiGate unit fo r RADIUS authentication - web-based manager 1 Go to User > Remote > RADIUS [...]

FortiOS v3.0 MR7 User Authentication User Guide 18 01-30007-0347-200808 28 RADIUS servers Authentication servers T o config ure the Forti Gate unit for RADIUS a uthenticat ion - CLI config user radius edit <server_name> set all-usergroup {enable | disable } set auth-type <authentication_protocol> set nas-ip <nas_ip_called_id> set [...]

Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 19 T o remove a RADIUS server from the For tiGate unit configuration - CLI config user radius delete <server_name> end LDAP servers Lightweight Directory Access Protocol (LDA P) is an Internet pr otocol use d to maintain authe ntication[...]

FortiOS v3.0 MR7 User Authentication User Guide 20 01-30007-0347-200808 28 LDAP servers Authentication servers FortiGate LDAP does no t support proprietar y functionality , such as notification of password expiration, which is available from some LDAP servers. F ortiGate LD AP does not supply inform ation to the user abou t why authen tication fail[...]

Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 21 The output is lengthy , but the information you need is in the first few lines: version: 2 # # filter: (objectclass=*) # requesting: ALL # dn: dc=example,dc=com dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=c[...]

FortiOS v3.0 MR7 User Authentication User Guide 22 01-30007-0347-200808 28 LDAP servers Authentication servers Figure 3: Configur e Fo rtiGate u nit for LDAP authentication Name Enter the name that id entifies the LDAP server on the FortiGate unit. Server Name/IP Enter the domain name or IP ad dress of the LDAP server . Server Port Enter the TCP po[...]

Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 23 T o configure the Fort iGate unit for LDAP authentic ation - CLI config user ldap edit <server_name> set cnid <common_name_identifier> set dn <distinguished_name> set port <port_number> set server <domain> set[...]

FortiOS v3.0 MR7 User Authentication User Guide 24 01-30007-0347-200808 28 LDAP servers Authentication servers T o remove an LDAP server from the Fort iGate unit configuration - CLI config user ldap delete <server_name> end Using the Query icon The LDAP Distinguish ed N ame Query list dis pla ys the LDA P Server IP address, and all the distin[...]

Authentication servers T ACACS+ servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 25 T ACACS+ servers In recent years, remote netwo rk access has shifted from term inal access to LAN access. Users are now connecting to thei r cor porate networ k (using note books or home PCs) with computers that utilize complete networ[...]

FortiOS v3.0 MR7 User Authentication User Guide 26 01-30007-0347-200808 28 T ACACS+ servers Authentication servers Figure 6: T ACACS+ ser ver co nfiguration T o configure the FortiGate unit for T ACACS+ authentication - CLI config user tacacs+ edit <server_name> set auth-type {ascii | auto | chap | ms_chap | pap} set key <server_key> se[...]

Authentication servers Directory Service servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 27 T o remove a T ACACS+ server from th e FortiGate unit configuration - CLI config user tacacs+ delete <server_name> end Directory Service servers Windows Active Directory (AD) an d Novell edi rector y provide central auth[...]

FortiOS v3.0 MR7 User Authentication User Guide 28 01-30007-0347-200808 28 Directory Service servers Authentication servers T o view the list of Directory Service servers, go to User > Directory Service . Figure 8: Example Directory Se rvice server list Configuring the FortiGate unit to use a Director y Service server Y ou need to configur e the[...]

Authentication servers Directory Service servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 29 For more information about FSAE, see the FSAE T e chnical Note . T o configure the FortiGate unit for Directory Service authen tication - web-based manager 1 Go to User > Direct ory Service and select Create New . 2 Enter t[...]

FortiOS v3.0 MR7 User Authentication User Guide 30 01-30007-0347-200808 28 Directory Service servers Authentication servers T o remove a Director y Service se rver fr om the For tiGate unit conf iguration - web-based manag er 1 Go to User > Directory Service . 2 Select the Delete icon beside the name of the Dire ctory Service server that you wan[...]

Authentication servers Directory Service servers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 31 Figure 1 1: Example Dir ecto ry Service server list Create New Add a new Directory Service server . Name Y ou can select th e Expand arrow beside the server/domai n/group name to display Directory Service domain and group info[...]

FortiOS v3.0 MR7 User Authentication User Guide 32 01-30007-0347-200808 28 Directory Service servers Authentication servers[...]

Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Au thentica tion User Guide 01-30007-0347-2008082 8 33 Users/peers and user group s FortiGate authentication controls system access by user group. First you configure users/peer s, then you create user group s and add users/peers to them. • Configure local user acco unts. For each user[...]

FortiOS v3.0 MR7 User Authentication User Guide 34 01-30007-0347-200808 28 Users/peers Users/peers and user groups This section describes how to configure local users and peer users. For information ab ou t co nf igu ra tio n of auth e nt ica tion ser ve rs se e “Authentication servers” on p age 15 . Creating local users T o de fin e a loc al u[...]

Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 35 T o view a list of all local users, go to User > Local . Figure 13: Loca l us e r lis t T o create a local user - CLI config user local edit <user_name> set type password set passwd <user_password> end or User Name T ype[...]

FortiOS v3.0 MR7 User Authentication User Guide 36 01-30007-0347-200808 28 Users/peers Users/peers and user groups config user local edit <user_name> set type ldap set ldap_server <server_name> end or config user local edit <user_name> set type radius set radius_server <server_name> end or config user local edit <user_nam[...]

Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 37 • a peer user name • the text from the subject field of the ce rtificate of the auth enticating peer user , or the CA certificate used to authenti cate the peer user . Y ou can configure a peer user with no values for the subje c t[...]

FortiOS v3.0 MR7 User Authentication User Guide 38 01-30007-0347-200808 28 Users/peers Users/peers and user groups T o create a peer user for PKI authenti cation - CLI config user peer edit <peer name> set subject <subject_string> set ca <ca_cert_string> end T o remove a PKI peer user from th e FortiGate unit configuration - web-b[...]

Users/peers and user groups User group s FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 39 User group s A user group is a list of user/peer identitie s. An identity can be: • a local user account (user name/pa ssword) stored on the FortiGate unit • a local user account with the password stored on a RADIUS, LDAP , or TA [...]

FortiOS v3.0 MR7 User Authentication User Guide 40 01-30007-0347-200808 28 User groups Users/peers and user groups For a Directory Service user group, the Directory Service server authen ticates users when they log o n to the ne twork. The FortiGate unit receives the user ’s name and IP address from the FSAE collector agent. Fo r more inform atio[...]

Users/peers and user groups User group s FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 41 For more informatio n about protection profiles, see the FortiGate Administration Guide . Configuring user groups Y ou create a user group by typing a n ame, selecting users and/or authentication servers, and selecting a protection pr[...]

FortiOS v3.0 MR7 User Authentication User Guide 42 01-30007-0347-200808 28 User groups Users/peers and user groups 3 Select OK. T o create a firewall use r group - CLI config user group edit <group_name> set group-type <grp_type> set member <user1> <user2> ... <user n > set profile <profile_name> end For more spe[...]

Users/peers and user groups User group s FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 43 Figure 19: User group configuratio n - Directory Service Configuring SSL VPN user groups For detailed instr uctions about how to configure SSL VPN web-only mode or tunnel mode operation, see the FortiGate SS L VPN User Guide . Name T [...]

FortiOS v3.0 MR7 User Authentication User Guide 44 01-30007-0347-200808 28 User groups Users/peers and user groups Configuring Peer user groups Peer user group s can only be configured using the CLI. Peers are di gital certificat e holders d efined us ing the config user peer command. Y ou use the peer group s you define here in the config vpn ipse[...]

Users/peers and user groups User group s FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 45 T o remove a user group from the FortiGate unit config uration - web-based manager 1 Go to User > User Group . 2 Select the Delete icon beside the name of the user group that you want to remove. 3 Select OK. Figure 21: Remove user [...]

FortiOS v3.0 MR7 User Authentication User Guide 46 01-30007-0347-200808 28 User groups Users/peers and user groups[...]

Configuring authenticated access Authentication timeout FortiOS v3.0 MR7 User Au thentica tion User Guide 01-30007-0347-2008082 8 47 Configuring authenticated access When you h ave configu red authentic ation serv ers, users, and user g roups, you are ready to configure firewall policies and cert ain types of VPNs to require user authenticatio n. T[...]

FortiOS v3.0 MR7 User Authentication User Guide 48 01-30007-0347-200808 28 Firewall policy authentication Configuring authentica ted access When user authentication is enable d on a firewall policy , the authentication challenge is normally issued for any of th e four protocols (dependent on th e connection protocol). By making selection s in the P[...]

Configuring authenticated access Firewall policy authenticati on FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 49 The style of the authe ntication m ethod varies by the authentication protocol. If you have selected HTTP , FTP or T elnet, user name and p assword-based authentication occurs: the FortiGate unit prompt s netwo[...]

FortiOS v3.0 MR7 User Authentication User Guide 50 01-30007-0347-200808 28 Firewall policy authentication Configuring authentica ted access 7 One at a time, select user group names from the Available Gro ups list and select the right-pointing arrow bu tton to move them to the Allowed list. All members of the groups in the Allowed list will be au th[...]

Configuring authenticated access Firewall policy authenticati on FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 51 The FortiGate unit performs au thenticat ion only on request s to access HTTP , HTTPS, FTP , and T elnet. Once the user is authenticated, th e user can access other services if the firewall policy permits. 4 Se[...]

FortiOS v3.0 MR7 User Authentication User Guide 52 01-30007-0347-200808 28 VPN authentication Configuring authentica ted access VPN authentication All VPN configurations require users to authenticate. Authentication based on user groups ap plies to: • SSL VPNs • PPT P and L2TP VPNs • an IPSec VPN that authenticates users using dialup group s [...]

Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 53 Server Certificate Select the signed server certificate to use for authentication purposes. If y ou leave the default setting (Self-Signed) , th e Fo rti G at e unit offer s its factory installed (self-signed) certific ate [...]

FortiOS v3.0 MR7 User Authentication User Guide 54 01-30007-0347-200808 28 VPN authentication Configuring authentica ted access T o configure authentication for an SSL VPN - CLI config vpn ssl settings set algorithm set auth-timeout set dns-server1 set dns-server2 set idle-timeout set portal-heading set reqclientcert set route-source-interface set [...]

Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 55 T o enable strong authentication for an SSL VPN 1 Go to VPN > SSL > Config . 2 Select Require Client Certific ate, and then select Apply . 3 Go to Firewall > Policy . 4 Select the Edit icon in the row that co rresp[...]

FortiOS v3.0 MR7 User Authentication User Guide 56 01-30007-0347-200808 28 VPN authentication Configuring authentica ted access 4 Enter S tarting IP and Ending IP addresses . This defines the range of ad dresses assigned to VPN clients. 5 Select the user group that is to have acce ss to this VPN. The FortiGate unit authenticates members of this use[...]

Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 57 2 Go to VPN > IPSec > Auto K ey (IKE), select Create Phase 1 and en te r th e following information. Figure 28: C onfigure VPN IPSec dial up authenti cation 3 Select Advanced to reveal additi onal parameters and confi[...]

FortiOS v3.0 MR7 User Authentication User Guide 58 01-30007-0347-200808 28 VPN authentication Configuring authentica ted access Configuring XAut h authentication Extended Authentication (XAuth) increases security by requiring additional user authentication in a sep arate exchan ge at the end o f the VPN Phase 1 negotiation. The FortiGate unit chall[...]

Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 828 59 3 Select Advanced to reveal add itional parameters and en ter the following information. 4 Configure other VPN gate way parameters as needed. 5 Select OK. For more informatio n about XAU TH configuration, see the FortiGate [...]

FortiOS v3.0 MR7 User Authentication User Guide 60 01-30007-0347-200808 28 VPN authentication Configuring authentica ted access[...]

Index FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 731 61 Index A Active Directory - see Directory Service administrator authentication 7 ASCII 25 attributes RADIUS 15 authenticated access configuring 47 authenticating users FortiGate 33 with LDAP servers 34 with RADIUS servers 34 with TACACS+ servers 34 authentication 54 abo[...]

FortiOS v3.0 MR7 User Authentication User Guide 62 01-30007-0347-200807 31 Index FSAE collector agent 27 FSAE domain controller 27 redundant configuration 28 removing from FortiGate configuration 30 retrieving information from LDAP server 28 viewing domain and group information 30 viewing list of 28 Directory Service user groups configuring 42 crea[...]

Index FortiOS v3.0 MR7 User Authentication User Guide 01-30007-0347-20080 731 63 list order changing 50 firewall policy 50 local users configuring 34 creating 34 deleting from FortiGate con figuration 36 removing from FortiGate configuration 36 viewing list of 35 M MS-CHAP 25 N Novell edirectory - see Directory Service P PAP 25 peer user groups con[...]

FortiOS v3.0 MR7 User Authentication User Guide 64 01-30007-0347-200807 31 Index timeout authentication 10 tunnel mode SSL VPN IP range 52 types of user groups 39 types of users 33 Typographic conventions 11 U user authentication IPSec VPN dialup users 56 L2TP VPN 56 PPTP VPN 55 protocols 47 SSL VPN 52 timeout 47 XAuth 58 user groups 39 about 9 cre[...]

www.fortinet.com[...]

www.fortinet.com[...]